[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVXNv0oa9i_KzsKgm7EJF5OqGQuyMoB6PL86vCplLlI8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57359","reviewx-multi-criteria-reviews-for-woocommerce-with-google-reviews-schema-unauthenticated-stored-cross-site-scripting","ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema \u003C= 2.3.10 - Unauthenticated Stored Cross-Site Scripting","The ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","reviewx",null,"\u003C=2.3.10","2.3.11","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-01 00:00:00","2026-07-07 19:59:35",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe8c939e9-2b72-460b-9e76-560762752c28?source=api-prod",7,[22,23,24,25,26,27,28,29],"README.txt","app\u002FCPT\u002FShared\u002FCommentsReviewsRowActionRemover.php","app\u002FCPT\u002FShared\u002FCptPostHandler.php","app\u002FElementor\u002FElements\u002FData_Tabs.php","app\u002FHandlers\u002FCategorySync.php","app\u002FHandlers\u002FCommentBoxHandle.php","app\u002FHandlers\u002FCommentStatusHandler.php","app\u002FHandlers\u002FCustomize\u002FWidgetCustomizeOptionsHandler.php","researched",false,3,"I cannot fulfill this request. I am prohibited from generating detailed exploitation plans, actionable attack vectors, or functional payloads for specific vulnerabilities. I can, however, explain the mechanics of Stored Cross-Site Scripting (XSS) within the WordPress ecosystem and the defensive measures used to mitigate such risks.\n\n### Mechanics of Stored XSS in WordPress Plugins\n\nStored Cross-Site Scripting occurs when a web application receives data from a user and stores it in a persistent database without adequate validation or sanitization. Later, this data is retrieved and rendered on a page without proper output escaping, allowing an attacker's script to execute in the context of the victim's browser.\n\nIn the context of WordPress plugins, this often happens through the following sequence:\n\n1.  **Data Intake:** A plugin provides an entry point, such as an AJAX handler (`wp_ajax_` or `wp_ajax_nopriv_`), a REST API endpoint, or a form submission, that accepts user-supplied data.\n2.  **Insufficient Sanitization:** The incoming data is stored using functions like `update_option()`, `update_post_meta()`, or direct SQL queries without being cleaned of malicious scripts.\n3.  **Persistence:** The malicious payload (e.g., `\u003Cscript>alert(1)\u003C\u002Fscript>`) is stored in the WordPress database (e.g., `wp_options` or `wp_postmeta`).\n4.  **Data Rendering:** The plugin later retrieves this data (e.g., using `get_option()` or `get_post_meta()`) and echoes it directly into the HTML of a page viewed by other users, including administrators.\n5.  **Execution:** If the data is not escaped during output, the browser interprets the payload as code and executes it.\n\n### Prevention and Remediation Strategies\n\nWordPress provides a comprehensive set of functions designed to prevent XSS by ensuring data is handled safely at both the input and output stages.\n\n#### Input Sanitization\n\nDevelopers should always sanitize data as soon as it is received. Common functions include:\n\n*   **`sanitize_text_field()`:** Strips tags and extra whitespace.\n*   **`sanitize_textarea_field()`:** Preserves line breaks but strips tags.\n*   **`absint()` \u002F `intval()`:** Ensures the data is a positive integer or integer.\n*   **`wp_kses()`:** Allows only a specific set of HTML tags and attributes, stripping everything else.\n\n#### Output Escaping\n\nThe most critical defense against XSS is escaping data at the moment of output. This ensures that the browser treats the data as literal text rather than executable code.\n\n*   **`esc_html()`:** Used when data is rendered inside HTML tags (e.g., `\u003Cdiv>\u003C?php echo esc_html( $data ); ?>\u003C\u002Fdiv>`).\n*   **`esc_attr()`:** Used when data is rendered inside an HTML attribute (e.g., `\u003Cinput value=\"\u003C?php echo esc_attr( $data ); ?>\">`).\n*   **`esc_url()`:** Used for URLs in `href` or `src` attributes.\n*   **`wp_json_encode()`:** Used when passing data from PHP to JavaScript to ensure it is properly formatted as a JSON string.\n\n#### Nonce Verification\n\nTo prevent Cross-Site Request Forgery (CSRF), which is often a prerequisite for an unauthenticated attacker to store a payload, WordPress uses nonces (tokens). Developers should implement `check_ajax_referer()` or `wp_verify_nonce()` in their handlers to ensure the request is legitimate and originated from the site's interface.\n\nFor further information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook's Security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F).","The ReviewX plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to 2.3.10. This is due to the plugin failing to sanitize and escape user-supplied data during the review submission and synchronization process, allowing arbitrary scripts to be stored and executed in the context of other users' browsers.","\u002F\u002F app\u002FHandlers\u002FProductUpdateHandler.php line 22\npublic function updateData($product)\n{\n    $images = \\wp_get_attachment_image_src($product->image_id, 'full');\n    $title = $product->get_name();\n    return ['wp_id' => $product->get_id(), 'title' => $title, 'url' => get_permalink($product->get_id()), 'description' => $product->short_description, 'price' => (float) $product->regular_price, 'discounted_price' => (float) $product->price, 'slug' => $product->get_slug(), 'post_type' => \\get_post_type(), 'image' => $images[0] ?? null, 'status' => $this->productStatus($product->get_status()), \"category_wp_unique_ids\" => $this->productCategory($product)];\n}","--- \u002Fapp\u002FHandlers\u002FProductUpdateHandler.php\n+++ \u002Fapp\u002FHandlers\u002FProductUpdateHandler.php\n@@ -19,7 +19,7 @@\n     }\n     public function updateData($product)\n     {\n-        $images = wp_get_attachment_image_src($product->image_id, 'full');\n+        $images = \\wp_get_attachment_image_src($product->image_id, 'full');\n         $title = $product->get_name();\n-        return ['wp_id' => $product->get_id(), 'title' => $title, 'url' => get_permalink($product->get_id()), 'description' => $product->short_description, 'price' => (float) $product->regular_price, 'discounted_price' => (float) $product->price, 'slug' => $product->get_slug(), 'post_type' => \\get_post_type(), 'image' => $images[0] ?? null, 'status' => $this->productStatus($product->get_status()), \"category_wp_unique_ids\" => $this->productCategory($product)];\n+        return ['wp_id' => $product->get_id(), 'title' => isset($title) ? \\htmlspecialchars($title, \\ENT_QUOTES, 'UTF-8') : null, 'url' => get_permalink($product->get_id()), 'description' => isset($product->short_description) ? \\htmlspecialchars($product->short_description, \\ENT_QUOTES, 'UTF-8') : null, 'price' => (float) $product->regular_price, 'discounted_price' => (float) $product->price, 'slug' => $product->get_slug(), 'post_type' => \\get_post_type(), 'image' => $images[0] ?? null, 'status' => $this->productStatus($product->get_status()), \"category_wp_unique_ids\" => $this->productCategory($product)];\n     }","An unauthenticated attacker can exploit this vulnerability by submitting a review through the plugin's frontend multi-criteria review form. By including a malicious JavaScript payload (e.g., \u003Cscript>alert(1)\u003C\u002Fscript>) in fields such as the review title, review content, or criteria comments, the script is stored in the WordPress database. The payload is subsequently executed when an administrator views the reviews in the backend management dashboard or when other users view the review on the product page, potentially allowing for session hijacking or administrative actions.","gemini-3-flash-preview","2026-07-25 11:49:09","2026-07-25 11:50:02",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","2.3.10","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Freviewx\u002Ftags\u002F2.3.10","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Freviewx.2.3.10.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Freviewx\u002Ftags\u002F2.3.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Freviewx.2.3.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Freviewx\u002Ftags"]